Web Ethical Hacking Tools - DirSearch Kali Linux

so we're gonna talk about a very important web ethical hacking tool used in web application penetration testing and also used in finding web vulnerabilities it's a directory brute force tool but still considered by many a vulnerability scanner we're gonna introduce the basics of their search it's not one of those available tools in kali linux by default but it's fast and it's free and you can also install it easily for those who are new to this channel welcome i am your host my name is dean armada and i'm the internet [Music] action star and on this channel we talk about tech careers and certifications trivia tutorials cyber security prevent tutorials in cloud and data center and my journey as an i.t instructor so feel free to check out the rest of the channel consider subscribing to effectively find bugs or web vulnerabilities you need to gather as many information as you could one of the most effective way is to use directory brute force this tool us to see the structure of the target website and find most if not all directories and files including the hidden ones and why do we want to see these hidden directories because it's possible developers might have saved hidden valuable or sensitive information in these directories sensitive information such as backup files system files passwords and many others so directory brute force tools how it works is you either use a word list of the most common directory and file names or you can also use pure brute force pure brute force will basically try to match every single pattern from the character set specified and obviously pure brute force is more resource intensive and longer time to finish it's also not very effective okay so dear search is not as common as other tools such as their buster is not installed in kali linux by default but most linux tools are easy to install anyway it's available also in windows and mac operating system their search is python based and is only available in cli but it's faster than most directory brute force tool our topology is very simple and we have two hosts our attacker is the kali linux and our target web application is the hackett php auction we're gonna simply run and test their search towards to the target web application here in our kali linux and the first thing that we're gonna do is we're gonna install our tool our directory brute force tool dear search and uh the reason why is because by default it's not installed uh in kali linux and we can actually check this if i do their search hit enter as you can see it says command not found so next is we're just going to update uh our call linux operating system first using app get update so i'll just uh enter the password and as you can see it's done reading package list done uh next is we're gonna install our dear search tool so i will use sudo and i will use app get as well now we're gonna add or append the command install plus the tool that we want to install which is their search and as you can see it's done they're upgraded but we have here one newly installed uh tool which is your search now if i do dear search again okay i will hit enter as you can see we're not getting an editor anymore but it's getting us a message we're getting a message that the url target is missing and we have to append more options before we run their search since it is a cli we can actually use the help tool so if i type their search dodge help as you can see we see all of the flags and we use these flags and settings uh to add some parameters and configuration but should we specify all of these flags and parameters the answer is no because there is a default configuration it is located uh at user bin lib python 3 and then distribution packages and at your search so here is the location okay and if i do ls you will see some of the files such as banner change log we also have some directories such as db and third-party directories but the default configuration are set on this configuration file the default.conf and what i'm going to do is i will concatenate a default dot configuration file and as you can see this is where the default configuration are set this includes the number of threads um and if we want to enable the recursion okay as you can see here the default extension as you can see these are php aspx jsp html njs you can modify this you can add more extensions or you can also uh remove some we also have http method which is get okay and uh here is the most important the word list so under dictionary uh there is a word list here there is a dvdi cc.text okay now what i'm gonna do is i'm gonna go back to our home directory and we're gonna run their search all right let's run their search so the command is very simple it's your search and if i hit enter we get an error it's saying that the url target is missing so all we need to do is add the flag dot you so if i um run again your search but this time with shoe and the target url which is http 192.168.2 [Music] so this is the target url and we're not gonna add any more parameters such as thread http method etc so we'll just hit enter and as you can see we it's starting to do the brute force okay and we also have some information here what extension that it's using or it's searching php aspx html.js these are the default the http method is get and the number of grid is 30 the wordless size is let's go back 10 000 plus and it also shows here that after this run the output file will be located at this home directory of cal linux and we have the file which is this file uh it is in a text format and we also have the error log file now as you can see it's already it has already started and we see some hidden files here now we also see admin directory with some of the files such as admin.php login.php and it also has searched many directories such as bras uh by uh comment contacts uh we also have feedback header images includes login okay and if i scroll down as you can see it's already complete now this is a strange behavior because i know there are more than 30 php files in the word root alone excuse me in the web root alone there are more than 30 php files and those files are not even detected here okay what else uh there are also more files under the admin directory more php files under include and templates and many more even the php my admin there are more files not only index.php so here's what we're gonna do well before we run again dear search i would like to show you something so we just want to check the output file first so if i scroll up we see the output file is home kali got your search reports and the target ip address so i will cd their search reports okay and the target starts with 192. there you go if i hit ls this is the file that we want to look at so i'm going to concatenate underscore 22 and as you can see this is the exact output we got from the previous brute force now we will run again your search but this time we will enable recursive so how do we enable recursive all we need to do is type your search and uh let's um go to the help tool and as you can see it says here recursive so it's dash r to enable recursive or dodge dodge recursive to brute force those directories recursively so we're gonna type their search and uh you know what let's just use our previews okay our previous command set your search doshu and the target is http 192.168.254.7 and this time i will just add r or dash dot r okay and i'm gonna hit enter and as you can see it's starting to brute force directory uh recursively so the first thing it did is it brute force and it found this hidden files and now it's starting to brute force uh the admin directory okay and uh let's wait a little after the admin uh it is now brute forcing the cgi bin okay but it's added to the queue meaning it's not done yet and it may continue brute forcing this directory and under cgi it's also found another directory test.cgi okay and uh we're getting more and more uh for example this login directory it has detected that there are more directories such as index cpanel etc now it gives us more output of the admin directory now under admin directory there are more subdirectories such as another admin okay and then under this admin admin directory there are more files okay such as log files and or dot js and dot jsps and we also have more phps more jsp files okay and as you can see we're getting a lot of files and directories now if we wait for more i'm pretty sure we're getting more than hundreds if not thousands of files okay and at this percentage here it's just for this directory okay it's uh it's actually very fast again compared to uh their buster uh but we want to see what files and directories will be found so let's just wait [Music] few minutes has already lapsed and let's check the progress i see lots of files here under this directory help okay uh yeah it's for the past few minutes it's checking or it's brute forcing this help directory and there's a lot of files there's a lot of directories inside this help directories okay we have more php more asp more jsp and many more now i don't think this will fit this will finish in an hour uh we're not gonna wait but at least we were able to test uh dear search recursively and we're getting uh positive results we are finding more and more files in multiple directories because it is brute forcing directories in a directory in a directory you know like the movie inception and we're seeing more and more files including the hidden ones this is just the basics of their search of course we have more options the advanced options such as authentication logging into the application with your user account html parsing adding custom http headers and many more and of course more web ethical hacking tools in other videos [Music]

Channel: Styx Show by Dean Armada

Views: 3,592

Keywords: Attacker, Cyber security, Dirbuster, Directory brute force, Directory brute force tools, Ethical hacking, Kali linux, Linux, Penetration testing, Web application, Web application penetration testing, Web exploitation, Web security, Web vulnerability, Wordlist, directory brute force attack, dirsearch kali install, dirsearch kali linux, dirsearch tool, web app penetration testing

Id: Rkb9I52Ht1c

Length: 14min 16sec (856 seconds)

Published: Fri May 27 2022